The difference between a pentest and a Red Team Engagement

A pentest is a technical vulnerability analysis within a defined scope. Valuable — but it does not answer the question: "If a targeted attacker really wants to hit us, can we stop them?"

A Red Team Engagement does provide that answer. We simulate an Advanced Persistent Threat: a patient, targeted attack scenario where we are allowed to use all the tactics a real adversary would use.

What type of Red Team suits your organization and needs?

Red Teaming is not a single service. The type depends on your sector, legal obligations, organizational maturity, and learning objectives. DEFION performs all the variants below.

Full Red Team Engagement

No announcement to the operational team. No limited scope. No hints. Our Red Teamers determine tactics, timing, and attack vector themselves — within the agreed rules of engagement. From initial reconnaissance and OSINT to social engineering, technical infiltration, lateral movement, and goal achievement. Your SOC does not know when it starts. Your CISO only finds out afterwards how far we got.

Suitable for: organizations with a mature and operational SOC that want to validate their detection capability under maximally realistic conditions.
Duration: 6–16 weeks depending on scope.

Bounded Red Team Engagement

Targeted attack simulation within a predetermined domain — external attack vectors, phishing and social engineering, cloud environment, or a specific supplier chain.

Useful when operational continuity does not allow full freedom, or when you want to thoroughly test one specific attack surface without burdening the rest of the organization.

Suitable for: organizations that want to address a blind spot purposefully, or that are not yet ready for an unbounded engagement.
Duration: 3–8 weeks.

Purple Team Engagement

Attack and defense in one combined exercise. Our Red Teamers execute techniques while your security team watches live, adjusts detection rules, and validates response procedures. Each technique is immediately translated into a detection gap or an improved SIEM rule.

Less realistic than an unbounded Red Team Engagement — but maximally educational.

OT Red Teaming

Attack simulation focused on industrial systems, SCADA, ICS, and operational technology — without risk to production continuity.

Most Red Team providers stop at the IT boundary. DEFION can fully include industrial environments in scope, including attack scenarios that exploit IT/OT convergence: from office network to production floor, from remote access to control logic. We know the specific threat actors targeting OT environments and the tactics they actually use.

Suitable for: manufacturing, energy, transport, water, critical infrastructure — any organization where a successful attack on OT systems endangers production, safety, or continuity.
Duration: 8–20 weeks depending on scope and OT complexity.

DNB Advanced Red Teaming (ART)

The DNB ART framework is an intelligence-led red team methodology for organizations under DNB supervision that are not yet ready for the full TIBER cycle. ART 2.0 is a structured intermediate step: heavier than a standard red team engagement, lighter in governance than TIBER.

An ART exercise follows a fixed phasing: preparation, threat intelligence, red team execution based on intelligence-led attack scenarios, and a mandatory purple team closure phase.

The ART framework is also used outside the financial sector — for hospitals and healthcare institutions under Z-CERT coordination (the so-called ZORRO framework) and for other critical infrastructure operators.

Suitable for: financial institutions and other organizations under DNB supervision that want to build their offensive test program towards TIBER or TLPT, and critical infrastructure sectors that want an ART-equivalent test.
Duration: 11–22 weeks.

TIBER-EU / TIBER-NL

The European framework for threat intelligence-based ethical red teaming of financial institutions, coordinated by the ECB and carried out in the Netherlands under DNB supervision. TIBER combines an independent Threat Intelligence Provider (TIP) with a Red Team Provider (RTP) in a controlled test of your production environment — including critical functions and critical third-party providers.

TIBER-NL was updated in February 2025 to fully align with the DORA TLPT standards. A successfully completed TIBER test can serve as TLPT evidence under DORA, provided it is conducted in accordance with the applicable RTS.

Suitable for: banks, payment institutions, pension funds, insurers, and other financial institutions under DNB or AFM supervision.
Duration: 9–14 months.

TLPT — DORA Article 26

Threat-Led Penetration Testing is a legal obligation as of January 17, 2025, for significant financial entities under DORA. The Regulatory Technical Standards come into effect on July 8, 2025 (EU 2025/1190). A full TLPT cycle every three years — or more often as directed by the competent authority.

DEFION guides you through the entire TLPT process: scope determination in coordination with the competent authority, coordination with the Threat Intelligence Provider, execution of the red team test on production systems, mandatory purple team closure, and delivery of the test report in accordance with RTS requirements.

Suitable for: financial institutions designated as significant under DORA (Article 26) — banks, payment institutions, investment firms, insurers.
Duration: 9–14 months.

Why DEFION?

OT expertise that most providers lack
Most Red Team providers stop at the IT boundary. We fully include OT environments, SCADA systems, and industrial networks in scope — with the knowledge and caution that this requires.

Connected with detection
Our Red Teamers also understand the detection side. They know which techniques modern EDR and SOC tooling recognize — and which they do not. This makes findings more actionable.

20 years of fieldwork as a foundation
DEFION conducts both red team operations and incident response. Our attackers also know what actually happens when a real attacker is in your environment — and what the damage is if detection fails.

One partner for the full spectrum
After a Red Team Engagement, you can turn to DEFION for pentesting, MDR, DFIR, and strategic advice. No handoff to another supplier.